perf: NULL ptr deref in perf_event_context_sched_in
From: Sasha Levin
Date: Tue Sep 09 2014 - 15:25:07 EST
Hi all,
While fuzzing with trinity inside a KVM tools guest running the latest -next
kernel, I've stumbled on the following spew:
[ 1181.492212] BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
[ 1181.500717] IP: perf_event_context_sched_in (kernel/events/core.c:333 kernel/events/core.c:2575)
[ 1181.500717] PGD 4b0d10067 PUD 4bcd66067 PMD 0
[ 1181.500717] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 1181.506884] Dumping ftrace buffer:
[ 1181.506884] (ftrace buffer empty)
[ 1181.506884] Modules linked in:
[ 1181.506884] CPU: 19 PID: 15980 Comm: trinity-c577 Not tainted 3.17.0-rc4-next-20140909-sasha-00032-gc16d47b-dirty #1132
[ 1181.506884] task: ffff8803a2b4b000 ti: ffff88049e4a4000 task.ti: ffff88049e4a4000
[ 1181.506884] RIP: perf_event_context_sched_in (kernel/events/core.c:333 kernel/events/core.c:2575)
[ 1181.516705] RSP: 0018:ffff88049e4a7a08 EFLAGS: 00010082
[ 1181.516705] RAX: 0000000000000000 RBX: ffff8809585d7b80 RCX: 00000113166c1a41
[ 1181.516705] RDX: 0000000000000003 RSI: ffff8803a2b4b000 RDI: ffff8803dd8069a0
[ 1181.516705] RBP: ffff88049e4a7a28 R08: 000000000007ce22 R09: 0000000000000000
[ 1181.516705] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8803dd8069a0
[ 1181.516705] R13: ffff8803a2b4b000 R14: 0000000000000002 R15: ffff8803f3943000
[ 1181.516705] FS: 00007ff20a25d700(0000) GS:ffff880958400000(0000) knlGS:0000000000000000
[ 1181.516705] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 1181.516705] CR2: 0000000000000040 CR3: 000000041017a000 CR4: 00000000000006a0
[ 1181.516705] Stack:
[ 1181.516705] 0000000000000002 ffff8809585d7b80 ffff8803a2b4b000 ffff8803f3943000
[ 1181.516705] ffff88049e4a7a78 ffffffffb52901f5 00000000001d4340 ffff8803f3943000
[ 1181.516705] ffff8803f3943000 0000000000000000 ffff8809585d7b80 ffff8803f3943000
[ 1181.516705] Call Trace:
[ 1181.516705] __perf_event_task_sched_in (kernel/events/core.c:2683)
[ 1181.516705] finish_task_switch (include/linux/perf_event.h:704 kernel/sched/core.c:2224)
[ 1181.516705] __schedule (kernel/sched/core.c:2834)
[ 1181.516705] ? __delayacct_blkio_start (kernel/delayacct.c:67)
[ 1181.516705] ? out_of_line_wait_on_bit (kernel/sched/wait.c:516)
[ 1181.516705] schedule (kernel/sched/core.c:2864)
[ 1181.516705] io_schedule (kernel/sched/core.c:4352)
[ 1181.516705] bit_wait_io (kernel/sched/wait.c:520)
[ 1181.516705] __wait_on_bit (kernel/sched/wait.c:329)
[ 1181.516705] ? put_lock_stats.isra.12 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254)
[ 1181.516705] wait_on_page_bit (mm/filemap.c:692)
[ 1181.516705] ? wake_atomic_t_function (kernel/sched/wait.c:301)
[ 1181.516705] __migration_entry_wait.isra.26 (include/linux/pagemap.h:507 mm/migrate.c:257)
[ 1181.516705] migration_entry_wait (mm/migrate.c:270)
[ 1181.516705] do_swap_page.isra.39 (mm/memory.c:2426)
[ 1181.516705] ? kvm_clock_read (./arch/x86/include/asm/preempt.h:90 arch/x86/kernel/kvmclock.c:86)
[ 1181.516705] ? sched_clock (./arch/x86/include/asm/paravirt.h:192 arch/x86/kernel/tsc.c:304)
[ 1181.516705] ? sched_clock_local (kernel/sched/clock.c:214)
[ 1181.516705] ? get_parent_ip (kernel/sched/core.c:2578)
[ 1181.516705] ? preempt_count_sub (kernel/sched/core.c:2634)
[ 1181.516705] __handle_mm_fault (mm/memory.c:3223 mm/memory.c:3341)
[ 1181.516705] handle_mm_fault (include/linux/memcontrol.h:120 mm/memory.c:3373)
[ 1181.516705] __do_page_fault (arch/x86/mm/fault.c:1231)
[ 1181.516705] ? vtime_account_user (kernel/sched/cputime.c:681)
[ 1181.516705] ? get_parent_ip (kernel/sched/core.c:2578)
[ 1181.516705] ? context_tracking_user_exit (include/linux/vtime.h:89 include/linux/jump_label.h:114 include/trace/events/context_tracking.h:47 kernel/context_tracking.c:180)
[ 1181.516705] ? preempt_count_sub (kernel/sched/core.c:2634)
[ 1181.516705] ? context_tracking_user_exit (kernel/context_tracking.c:184)
[ 1181.516705] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63)
[ 1181.516705] ? trace_hardirqs_off_caller (kernel/locking/lockdep.c:2640 (discriminator 2))
[ 1181.516705] trace_do_page_fault (arch/x86/mm/fault.c:1314 include/linux/jump_label.h:114 include/linux/context_tracking_state.h:27 include/linux/context_tracking.h:45 arch/x86/mm/fault.c:1315)
[ 1181.516705] do_async_page_fault (arch/x86/kernel/kvm.c:265)
[ 1181.516705] async_page_fault (arch/x86/kernel/entry_64.S:1314)
[ 1181.516705] Code: 7d f8 c9 c3 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 83 ec 20 4c 89 65 f0 49 89 fc 4c 89 6d f8 49 89 f5 48 89 5d e8 48 8b 07 <48> 8b 58 40 e8 ca ee 8d 00 89 c0 48 03 1c c5 c0 7e 2b bb 4c 39
All code
========
0: 7d f8 jge 0xfffffffffffffffa
2: c9 leaveq
3: c3 retq
4: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
b: 00 00 00
e: 55 push %rbp
f: 48 89 e5 mov %rsp,%rbp
12: 48 83 ec 20 sub $0x20,%rsp
16: 4c 89 65 f0 mov %r12,-0x10(%rbp)
1a: 49 89 fc mov %rdi,%r12
1d: 4c 89 6d f8 mov %r13,-0x8(%rbp)
21: 49 89 f5 mov %rsi,%r13
24: 48 89 5d e8 mov %rbx,-0x18(%rbp)
28: 48 8b 07 mov (%rdi),%rax
2b:* 48 8b 58 40 mov 0x40(%rax),%rbx <-- trapping instruction
2f: e8 ca ee 8d 00 callq 0x8deefe
34: 89 c0 mov %eax,%eax
36: 48 03 1c c5 c0 7e 2b add -0x44d48140(,%rax,8),%rbx
3d: bb
3e: 4c 39 00 cmp %r8,(%rax)
Code starting with the faulting instruction
===========================================
0: 48 8b 58 40 mov 0x40(%rax),%rbx
4: e8 ca ee 8d 00 callq 0x8deed3
9: 89 c0 mov %eax,%eax
b: 48 03 1c c5 c0 7e 2b add -0x44d48140(,%rax,8),%rbx
12: bb
13: 4c 39 00 cmp %r8,(%rax)
[ 1181.516705] RIP perf_event_context_sched_in (kernel/events/core.c:333 kernel/events/core.c:2575)
[ 1181.516705] RSP <ffff88049e4a7a08>
[ 1181.516705] CR2: 0000000000000040
Thanks,
Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/